EP3554000B1

EP3554000B1 - Validation code based verification method and device

Info

Publication number: EP3554000B1
Application number: EP17879427.7A
Authority: EP
Inventors: Chao XIU; Lei Wang; Xing Chen; Chuanzhi LI; Yongzhi Zhang
Original assignee: Advanced New Technologies Co Ltd
Current assignee: Advanced New Technologies Co Ltd
Priority date: 2016-12-08
Filing date: 2017-11-29
Publication date: 2021-05-19
Anticipated expiration: 2037-11-29
Also published as: TWI756266B; CN106899411A; JP6894511B2; EP3554000A1; TW201822048A; SG11201905215TA; KR20190091529A; PL3554000T3; CN106899411B; US20190251243A1; ES2882535T3; EP3554000A4; WO2018103564A1; JP2020501279A; US10719599B2; KR102194072B1

Description

TECHNICAL FIELD

The present application relates to the field of computer technologies, and in particular, to a method and apparatus for verification based on a verification code.

BACKGROUND

Currently, a verification code, also referred to as Completely Automated Public Turing test to tell Computers and Humans Apart (CAPTCHA), is widely used as a secure verification method. The verification code can be used to determine whether an operator is a user or an unauthorized program. The verification code can prevent unauthorized operations such as a malicious attempt to log in to a user account, cracking of a user password through enumeration, or sales volume manipulation or speaking through script control.
In the existing technology, to prevent the unauthorized program from automatically recognizing the verification code, a method for displaying the verification code is increasingly complex. The verification code is usually displayed by using the following methods: In a first method, as shown in FIG. 1a, the verification code is expressed by using a number or a text, and a background is added into a verification code display area, or the number or the text is distorted, to improve interference of the verification code. In a second method, as shown in FIG. 1b, a plurality of pictures and prompt information are provided, so that the user recognizes a corresponding quantity of specific pictures from the plurality of similar pictures based on the prompt information.
However, in the previous methods, the verification code is displayed by using a relatively complex method. Although an unauthorized script's automatic recognition can be interfered with, additional interference is also caused to the user. In other words, after the previous verification code is displayed to the user, a possibility that the user incorrectly recognizes the verification code increases. If an error occurs, the user needs to refresh the verification code and continue to recognize the newly generated verification code, until the verification succeeds. Apparently, the previous verification process in the existing technology possibly takes a long time. In particular, when a recognition error occurs, the user needs to repeatedly perform verification.
Document "Towards human interactive proofs in the text-domain using. the problem of sense-ambiguity for security" by BERGMAIR R ET AL, discloses presenting multiple replacements of texts to the user for assessment and depending of its accuracy and number of correct found synonyms, the user is judged as human or machine. US2012210393 discloses converting in the question to the user characters of a word by switching characters of the word or adding new characters.

SUMMARY

Implementations of the present application provide a method for verification based on a verification code, to alleviate a problem in the existing technology that a relatively long time is consumed in a verification process as a user is likely to incorrectly recognize a verification code.
The implementations of the present application provide an apparatus for verification based on a verification code, to alleviate a problem in the existing technology that a relatively long time is consumed in a verification process as a user is likely to incorrectly recognize a verification code.
The following technical solutions are used in the implementations of the present application.
An implementation of the present application provides a method for verification based on a verification code, including: receiving a verification request; obtaining a pre-generated first character string after receiving the verification request, where the first character string includes at least one variable character; replacing some or all variable characters with backup characters based on a pre-established correspondence between variable characters and backup characters, to obtain a second character string; and generating a verification code based on the second character string, and verifying a user corresponding to the verification request.
An implementation of the present application provides an apparatus for verification based on a verification code, including: a receiving module, configured to receive a verification request; an acquisition module, configured to obtain a pre-generated first character string after the verification request is received, where the first character string includes at least one variable character; a replacement module, configured to replace some or all variable characters with backup characters based on a pre-established correspondence between variable characters and backup characters, to obtain a second character string; and a verification module, configured to generate a verification code based on the second character string, and verify a user corresponding to the verification request.
At least one of the technical solutions used in the implementations of the present application can achieve the following beneficial effects:
When a server of a service provider verifies the user, the server performs a character replacement operation on a verification code. For the user, a verification code generated through character replacement does not affect the user in terms of understanding a meaning of the verification code. In addition, characters in the verification code in the implementations of the present application do not undergo character distortion, color change, or background addition. As such, the user can conveniently and accurately recognize the verification code. For a computer program, the verification code obtained after character replacement possibly includes a plurality of types of characters, and does not comply with a common syntax. As such, it is difficult for the computer program to effectively recognize content represented by the verification code based on a recognition algorithm, thereby effectively reducing a possibility that the computer program performs an unauthorized operation.
Compared with a verification method in the existing technology, the verification method provided in the implementations of the present application increases discemibility of the verification code, so that the user can intuitively understand the meaning of the verification code. Therefore, accuracy of recognizing the verification code by the user can be increased, and a time consumed in a verification process can be reduced. In addition, difficulty of recognizing the verification code by the computer program can be increased, and a possibility that the computer program performs an unauthorized operation can be effectively reduced.

BRIEF DESCRIPTION OF DRAWINGS

The accompanying drawings described here are intended to provide a further understanding of the present application, and constitute a part of the present application. The illustrative implementations of the present application and descriptions of the implementations are intended to describe the present application, and impose no limitation on the present application. In the accompanying drawings:

FIG. la and FIG. 1b are schematic diagrams illustrating verification codes in the existing technology;
FIG. 2a is a schematic diagram illustrating an architecture on which a process for verification based on a verification code is based, according to an implementation of the present application;
FIG. 2b is a schematic diagram illustrating a process for verification based on a verification code, according to an implementation of the present application;
FIG. 3 is a schematic diagram illustrating an architecture on which a method for generating a verification code used for character replacement is based, according to an implementation of the present application;
FIG. 4a and FIG. 4b are schematic diagrams illustrating verification interfaces in different verification methods, according to an implementation of the present application; and
FIG. 5 is a schematic structural diagram illustrating an apparatus for verification based on a verification code, according to an implementation of the present application.

DESCRIPTION OF IMPLEMENTATIONS

To make the objectives, technical solutions, and advantages of the present application clearer, the following comprehensively describes the technical solutions of the present application with reference to specific implementations and accompanying drawings of the present application. Apparently, the described implementations are merely some rather than all of the implementations of the present application.
It is worthwhile to note that, in the implementations of the present application, a verification process can be based on an architecture shown in FIG. 2a, and the verification process can be implemented by a server on the back end of an online service provider. The online service provider includes but is not limited to a service provider that can provide an online service, such as a website, a telecommunications operator, or a data center. The server used to implement the verification process can be a server responsible for security maintenance, for example, a security center server on the back end of the online service provider. No limitation is imposed on the present application here. In the subsequent descriptions, the server on the back end of the online service provider is collectively referred to as a server.
A user can be understood as an operator who uses a service provided by the online service provider. It is worthwhile to note here that, in a verification scenario in the implementations of the present application, an authorized operator is an actual person, and an unauthorized operator is a computer script, a program, etc.
The technical solutions provided in the implementations of the present application are described in detail below with reference to the accompanying drawings.
FIG. 2b shows a process for verification based on a verification code in an implementation of the present application. The process includes the steps below.
S201. Receive a verification request.
In this implementation of the present application, the verification request is usually generated after verification is triggered. In actual operations, the verification request can be triggered by a user, or can be triggered by a server based on demands in actual applications.
In a possible scenario, the user can actively send a verification request. In this case, the verification request is used to trigger a process for verification based on a verification code. In an implementation of this scenario, the process for verification based on a verification code can be used for account login. In other words, after the user enters a login interface (such as an account login interface of a website), it can be considered that the user sends a verification request, and the server correspondingly receives the verification request sent by the user.
In another possible scenario, the server can verify an identity of the user based on a corresponding security rule. For example, the server actively generates a verification code at a pre-determined cycle. Alternatively, when determining that some operations of the user are risky, the server actively generates a verification code and initiates verification to the user, to determine that the operations are not performed by a computer program. Certainly, no limitation is imposed on the present application here.
S202. Obtain a pre-generated first character string after receiving the verification request.
The first character string includes at least one variable character.
The first character string can be understood as a marking character string that includes a number, a text, etc., and has an indication function.
In actual application scenarios, the marking character string is easily recognized by the computer program, thereby increasing a risk of the verification process. Therefore, in this implementation of the present application, the first character string includes a variable character, and the variable character can be replaced with another character, so as to have an interference effect.
S203. Replace some or all variable characters with backup characters based on a pre-established correspondence between variable characters and backup characters, to obtain a second character string.
The backup character can be the same type of character as the variable character. For example, both the backup character and the variable character are Chinese characters, English characters, or numeric characters. Alternatively, the backup character and the variable character can be different types of characters. In an implementation of the present application, a Chinese character can be changed to pinyin. For example, "
" is changed to "hong". In another implementation, a certain word (or phrase) can be changed to a homophonous word (or phrase). For example, "
" can be changed to "
".
It is worthwhile to note that, a meaning of the second character string obtained after character replacement does not change, that is, the user can still understand the meaning of the verification code and perform a corresponding operation based on the verification code.
S204. Generate a verification code based on the second character string, and verify a user corresponding to the verification request.
In actual operations, the verification code can be displayed in a format of picture or text information, and is used to instruct the user to perform a certain operation. No limitation is imposed on the present application here.
The second character string is a character string obtained after character replacement. Therefore, the verification code generated based on the second character string can have an interference effect. Compared with an interference method in the existing technology such as character distortion, color change, or background addition, the meaning of the verification code obtained after character replacement in this implementation of the present application does not change. In addition, because the verification code is not displayed by using a complex method, the user can understand the meaning of the verification code and can easily recognize the verification code. Further, because character replacement is performed, it is difficult for a machine to recognize the verification code.
In the previous descriptions, after the verification code is generated, verification can be performed on a corresponding operator (that is, the user) to determine whether the operator is the user or the computer program.
Certainly, in a feasible implementation of the present application, the verification code can be displayed to the user in a corresponding verification interface (such as a login interface), and after the user performs a corresponding operation based on the verification code, verification is performed on the operation based on marking verification information.
Based on the previous steps, when a server of a service provider verifies the user, the server performs a character replacement operation on a verification code. For the user, a verification code generated through character replacement does not affect the user in terms of understanding a meaning of the verification code. In addition, characters in the verification code in this implementation of the present application do not undergo character distortion, color change, or background addition. As such, the user can conveniently and accurately recognize the verification code. For the computer program, the verification code obtained after character replacement possibly includes a plurality of types of characters, and does not comply with a common syntax. As such, it is difficult for the computer program to effectively recognize content represented by the verification code based on a recognition algorithm, thereby effectively reducing a possibility that the computer program performs an unauthorized operation.
Compared with a verification method in the existing technology, the verification method provided in this implementation of the present application increases discernibility of the verification code, so that the user can intuitively understand the meaning of the verification code. Therefore, accuracy of recognizing the verification code by the user can be increased, and a time consumed in a verification process can be reduced. In addition, difficulty of recognizing the verification code by the computer program can be increased, and a possibility that the computer program performs an unauthorized operation can be effectively reduced.
It is worthwhile to note that, in this implementation of the present application, because the meaning of the verification code does not change after character replacement is performed on the verification code, characters in the verification code are actually replaced with homophonous or synonymous characters. That is, the pre-establishing a correspondence between variable characters and backup characters specifically includes: determining at least one homophonous character and/or synonymous character of any variable character; using the determined homophonous character and/or synonymous character as a backup character of the variable character, and establishing a correspondence between the backup character and the variable character.
It can be considered that the first character string described above is generated in advance based on a corresponding verification code generation rule and stored in a database on a server side, and FIG. 3 is a schematic diagram of an architecture of generating the first character string.
During character replacement, only some variable characters can be replaced. For example, a character string of a certain verification code is a character string of "
". Assume that the six Chinese characters in the character string are all variable characters. In actual operations, only two variable characters "
" and "
" can be replaced. Assume that the two variable characters respectively correspond to backup characters "
" and "
". Therefore, the second character string obtained after the variable characters are replaced with the backup characters is "

".
Certainly, all characters can be replaced. For example, assume that two characters in the first character string "
" are both variable characters, and backup characters respectively corresponding to the two characters are pinyin "hong" and "qiu". The second character string obtained after character replacement is "hongqiu".
In actual applications, if variable characters correspond to different backup characters, a hybrid replacement method can be used. For example, the first character string "
" is replaced with "xuan
hong
".
Apparently, based on the previous replacement method, the user can understand the meaning represented by the characters in the verification code, but the computer program is subject to relatively strong interference.
In actual operations, a corresponding verification code can be generated based on the second character string obtained after character replacement. The generating a verification code based on the second character string specifically includes: generating a verification code in a specified format based on the second character string. The specified format includes at least one of a picture format and a text format.
In actual application scenarios, the user generally performs a certain operation based on the verification code. For example, the user enters a corresponding character string based on the verification code, or the user performs a certain operation based on behavior indicated by the verification code. However, regardless of whether the user enters a character string or performs a certain operation, the server needs to perform verification. To ensure verification accuracy, the server determines a verification standard. It can be understood that the marking verification information is a verification standard, and only when an operation of the user satisfies the verification standard, the verification can succeeds.
In a verification method in the actual application scenario, the user can enter a corresponding character string based on the verification code displayed in the verification interface. In this method, the marking verification information is the first character string. The verifying a user corresponding to the verification request specifically includes: generating an input area in a user verification interface; obtaining a character string that is to be verified and is entered by the user in the input area based on the verification code; and verifying, based on the first character string, the character string to be verified.
That is, FIG. 4a shows a verification interface in this method. It can be seen that the verification interface includes a verification code and a corresponding input area. The user enters a corresponding character string in the input area based on the verification code for verification. Certainly, in FIG. 4a, the verification can succeed only when the user enters a Chinese phrase "
" (assume that the first character string is "
") in the input area based on the verification code "hong
" (which is the second character string in the verification code).
In another verification method in the actual application scenario, the user can perform a corresponding verification operation based on the verification code displayed in the verification interface. In this method, the marking verification information includes pre-determined marking operation information. The verifying a user corresponding to the verification request specifically includes: generating an operable verification code display area in a user verification interface; obtaining operation information that is to be verified and that is corresponding to an operation that is to be verified and that is performed by the user in the verification code display area based on the verification code; and verifying, based on the marking operation information, the operation information to be verified.
FIG. 4b shows a verification interface in this method. It can be seen that the verification interface includes an operable verification code display area that includes a verification code. The user can perform a corresponding operation to be verified in the verification code display area based on behavior indicated by the verification code. In FIG. 4b, assume that the marking operation information is that operation controls "2" and "4" are tapped. In this case, the verification can succeed after the user taps the operation controls "2" and "4" in the verification code display area based on the verification code "Tap ou
in the picture below".
Certainly, the previous two methods are merely intended to describe the verification method in this implementation of the present application, and impose no limitation on the present application.
The verification method provided in an implementation of the present application is described above. Based on the same idea, an implementation of the present application further provides an apparatus for verification based on a verification code.
As shown in FIG. 5, the verification apparatus is disposed on a server side of a service provider, and the apparatus includes: a receiving module 501, configured to receive a verification request; an acquisition module 502, configured to obtain a pre-generated first character string after the verification request is received, where the first character string includes at least one variable character; a replacement module 503, configured to replace some or all variable characters with backup characters based on a pre-established correspondence between variable characters and backup characters, to obtain a second character string; and a verification module 504, configured to generate a verification code based on the second character string, and verify a user corresponding to the verification request.
The apparatus further includes an establishment module 505, configured to determine at least one homophonous character and/or synonymous character of any variable character; and use the determined homophonous character and/or synonymous character as a backup character of the variable character, and establish a correspondence between the backup character and the variable character.
The verification module 504 generates a verification code in a specified format based on the second character string, where the specified format includes at least one of a picture format and a text format.
The verification module 504 generates an input area in a user verification interface; obtains a character string that is to be verified and is entered by the user in the input area based on the verification code; and verifies, based on the first character string, the character string to be verified.
The verification module 504 generates an operable verification code display area in a user verification interface; obtains operation information that is to be verified and is corresponding to an operation that is to be verified and is performed by the user in the verification code display area based on the verification code; and verifies, based on pre-determined marking operation information, the operation information to be verified.
In the 1990s, whether a technical improvement is a hardware improvement (for example, an improvement to a circuit structure such as a diode, a transistor, or a switch) or a software improvement (an improvement to a method procedure) can be clearly distinguished. However, as technologies develop, current improvements to many method procedures can be considered as direct improvements to hardware circuit structures. A designer usually programs an improved method procedure into a hardware circuit, to obtain a corresponding hardware circuit structure. Therefore, a method procedure can be improved by using a hardware entity module. For example, a programmable logic device (PLD) (such as a field programmable gate array (FPGA)) is such an integrated circuit, and a logical function of the PLD is determined by a user through device programming. The designer performs programming to "integrate" a digital system to a PLD without requesting a chip manufacturer to design and produce an application-specific integrated circuit chip. In addition, at present, instead of manually manufacturing an integrated chip, this type of programming is mostly implemented by using "logic compiler" software. The software is similar to a software compiler used to develop and write a program. Original code needs to be written in a particular programming language for compilation. The language is referred to as a hardware description language (HDL). There are many HDLs, such as the Advanced Boolean Expression Language (ABEL), the Altera Hardware Description Language (AHDL), Confluence, the Cornell University Programming Language (CUPL), HDCal, the Java Hardware Description Language (JHDL), Lava, Lola, MyHDL, PALASM, and the Ruby Hardware Description Language (RHDL). The very-high-speed integrated circuit hardware description language (VHDL) and Verilog are most commonly used. A person skilled in the art should also understand that a hardware circuit that implements a logical method procedure can be readily obtained once the method procedure is logically programmed by using the several described hardware description languages and is programmed into an integrated circuit.
A controller can be implemented by using any appropriate method. For example, the controller can be a microprocessor, a processor, or a computer-readable medium storing computer readable program code (such as software or firmware) that can be executed by the microprocessor or the processor, a logic gate, a switch, an application-specific integrated circuit (ASIC), a programmable logic controller, or an embedded microprocessor. Examples of the controller include but are not limited to the following microprocessors: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320. The memory controller can also be implemented as a part of the control logic of the memory. A person skilled in the art also knows that, in addition to implementing the controller by using the computer readable program code, logic programming can be performed on method steps to enable the controller to implement the same function in forms of the logic gate, the switch, the application-specific integrated circuit, the programmable logic controller, and the embedded microcontroller. Therefore, the controller can be considered as a hardware component, and an apparatus configured to implement various functions in the controller can also be considered as a structure in the hardware component. Or the apparatus configured to implement various functions can even be considered as both a software module implementing the method and a structure in the hardware component.
The system, apparatus, module, or unit illustrated in the previous implementations can be implemented by using a computer chip or an entity, or can be implemented by using a product having a certain function. A typical implementation device is a computer. The computer can be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smartphone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.
For ease of description, the apparatus above is described by dividing functions into various units. Certainly, when the present application is implemented, functions of each unit can be implemented in one or more pieces of software and/or hardware.
A person skilled in the art should understand that an implementation of the present application can be provided as a method, a system, or a computer program product. Therefore, the present application can use a form of hardware only implementations, software only implementations, or implementations with a combination of software and hardware. Moreover, the present application can use a form of a computer program product that is implemented on one or more computer-usable storage media (including but not limited to a disk memory, a CD-ROM, or an optical memory) that include computer-usable program code.
The present application is described with reference to the flowcharts and/or block diagrams of the method, the device (system), and the computer program product based on the implementations of the present application. It is worthwhile to note that computer program instructions can be used to implement each process and/or each block in the flowcharts and/or the block diagrams and a combination of a process and/or a block in the flowcharts and/or the block diagrams. These computer program instructions can be provided for a general-purpose computer, a dedicated computer, an embedded processor, or a processor of another programmable data processing device to generate a machine, so that the instructions executed by the computer or the processor of the another programmable data processing device generate a device for implementing a specific function in one or more processes in the flowcharts and/or in one or more blocks in the block diagrams.
These computer program instructions can be stored in a computer readable memory that can instruct the computer or the another programmable data processing device to work in a specific way, so that the instructions stored in the computer readable memory generate an artifact that includes an instruction device. The instruction device implements a specific function in one or more processes in the flowcharts and/or in one or more blocks in the block diagrams.
These computer program instructions can be loaded onto the computer or another programmable data processing device, so that a series of operations and operations and steps are performed on the computer or the another programmable device, thereby generating computer-implemented processing. Therefore, the instructions executed on the computer or the another programmable device provide steps for implementing a specific function in one or more processes in the flowcharts and/or in one or more blocks in the block diagrams.
In a typical configuration, a computing device includes one or more processors (CPU), one or more input/output interfaces, one or more network interfaces, and one or more memories.
The memory can include a non-persistent memory, a random access memory (RAM), a non-volatile memory, and/or another form in a computer readable medium, for example, a read-only memory (ROM) or a flash memory (flash RAM). The memory is an example of the computer readable medium.
The computer readable medium includes persistent, non-persistent, movable, and unmovable media that can store information by using any method or technology. The information can be a computer readable instruction, a data structure, a program module, or other data. Examples of a computer storage medium include but are not limited to a phase-change random access memory (PRAM), a static random access memory (SRAM), a dynamic random access memory (DRAM), another type of random access memory (RAM), a read-only memory (ROM), an electrically erasable programmable read-only memory (EEPROM), a flash memory or another memory technology, a compact disc read-only memory (CD-ROM), a digital versatile disc (DVD) or another optical storage, a cassette magnetic tape, a magnetic tape/magnetic disk storage or another magnetic storage device, or any other non-transmission medium. The computer storage medium can be used to store information accessible by a computing device. Based on the definition in the present specification, the computer readable medium does not include transitory computer readable media (transitory media), for example, a modulated data signal and carrier.
It is worthwhile to further note that the term "include", "comprise", or their any other variants is intended to cover a non-exclusive inclusion, so a process, a method, a product, or a device that includes a list of elements not only includes those elements but also includes other elements which are not expressly listed, or further includes elements inherent to such a process, method, product, or device. Without more constraints, an element preceded by "includes a ..." does not preclude the existence of additional identical elements in the process, method, product, or device that includes the element.
A person skilled in the art should understand that an implementation of the present application can be provided as a method, a system, or a computer program product. Therefore, the present application can use a form of hardware only implementations, software only implementations, or implementations with a combination of software and hardware. In addition, the present application can use a form of a computer program product that is implemented on one or more computer-usable storage media (including but not limited to a disk memory, a CD-ROM, or an optical memory) that include computer-usable program code.
The present application can be described in the general context of computer executable instructions executed by a computer, for example, a program module. Generally, the program module includes a routine, a program, an object, a component, a data structure, etc. that executes a specific task or implements a specific abstract data type. The present application can also be practiced in distributed computing environments. In the distributed computing environments, tasks are performed by remote processing devices connected through a communications network. In the distributed computing environment, the program module can be located in both local and remote computer storage media including storage devices.
The implementations in the present specification are described in a progressive way. For same or similar parts of the implementations, references can be made to the implementations. Each implementation focuses on a difference from other implementations. Particularly, a system implementation is basically similar to a method implementation, and therefore is described briefly. For related parts, references can be made to related descriptions in the method implementation.
The previous descriptions are only implementations of the present application, and are not intended to limit the present application. A person skilled in the art can make various modifications and changes to the present application.

Claims

A method for verification based on a verification code, the method comprising:
receiving (S201) a verification request;

obtaining (S202) a pre-generated first character string after receiving the verification request, wherein the first character string comprises at least one variable character;

replacing (S203) some or all variable characters with backup characters based on a pre-established correspondence between variable characters and backup characters, to obtain a second character string, wherein the first character string has a meaning and the second character string has the same meaning to a person;

generating (S204) a verification code based on the second character string, wherein characters in the verification code do not undergo character distortion, color change, or background addition, and the verification code has the same meaning to a person;

displaying the verification code and an input area corresponding to the verification code, wherein the input area includes a plurality of selectable items, and the verification code is displayed in the form of text information that instructs a user to select one or more selectable items from the plurality of selectable items;

receiving a user input in the input area from the user, the user input corresponding to the verification code; and

verifying (S204) the user corresponding to the verification request as being a person based on the user input and the first character string.
The method according to claim 1, comprising:
generating the pre-established correspondence between the variable characters and the backup characters, the generating comprising:
determining at least one of a homophonous character and a synonymous character of any variable character;

using the at least one of the determined homophonous character and the synonymous character as a backup character of said any variable character; and

establishing a correspondence between the backup character and said any variable character.
The method according to claim 1, wherein verifying the user corresponding to the verification request specifically comprises:
generating an input area in a user verification interface;

obtaining a character string that is to be verified and is entered by the user in the input area based on the verification code; and

verifying, based on the first character string, the character string to be verified.
The method according to claim 1, wherein verifying the user corresponding to the verification request specifically comprises:
generating an operable verification code display area in a user verification interface;

obtaining operation information that is to be verified and is corresponding to an operation that is to be verified and is performed by the user in the verification code display area based on the verification code; and

verifying, based on pre-determined marking operation information, the operation information to be verified.
The method according to claim 1, wherein the variable character and the backup character correspond to same types of characters.
The method according to claim 1, wherein the first character string is generated in advance based on a corresponding verification code generation rule and stored in a database on a server side.
An apparatus for verification based on a verification code, the apparatus comprising a plurality of modules (501, 502, 503, 504, 505) configured to perform the method of any one of claims 1 to 6.